An Abnormal Commitment to Security and Privacy

Customers place tremendous trust in Abnormal to protect them from the full spectrum of attacks when they provide us access to the email stored in Microsoft 365 or Google Workspace. To that end, we’re focused on protecting your data and building your trust. This post describes our latest product security enhancements and our relentless commitment to protecting customer data.

We diligently follow key privacy and data protection principles for data minimization and processing purpose limitations, and maintain security, integrity, and confidentiality to ensure customer data is appropriately protected in alignment with global privacy frameworks. We also use industry-standard software development lifecycle processes to ensure all production code is fully peer-reviewed and deployed via approved methods.

As part of our December 2021 product security enhancements, we have changed the Abnormal portal session timeout logic to automatically sign out a user after 60 minutes of inactivity, with a maximum user session length of one day. If desired, each customer can request custom timeout intervals that better conform with their own security policies, such as setting the timeout value to 15 minutes. As a result, customers benefit from increased security measures and uninterrupted sessions.

It is recommended wherever possible to use multi-factor authentication (MFA) as one of the most effective deterrents for preventing account takeover attacks. We support Okta for both SSO and MFA.

Our newly expanded role-based access controls functionality enables customers to restrict access to specific tenants and administrative functions based on the user’s assigned roles and permissions. The expansive range of roles combined with per-product permissioning ensures more control while maintaining usability and ease of use.

The additional enterprise-grade granular permissions, particularly for obscuring message bodies and per tenant permissions, sets the foundation for granular permissioning and will support new product features added in the future.

This further enhances security, privacy, and compliance, proving extremely valuable for larger enterprise customers with users in different divisions, departments, or teams across diverse geographies.

The protection of our customer’s data is of paramount importance. To demonstrate the design and effectiveness of our security controls within our environment, an independent third-party audit is conducted annually, and Abnormal maintains a SOC 2 Type 2 report due to this regular audit activity. Upon request, we can share security framework reports and security control responses with external entities under a non-disclosure agreement (NDA).

As of December 21, 2021, Abnormal adheres to the following privacy regulations and compliance certifications:

Compliance

• ISO 27001:2013 Certified

• SOC 2 Type 2 Certified

Privacy Regulations

• California Consumer Privacy Act (CCPA) of 2018

• UK Data Protection Act of 2018

Amazing products and lasting partnerships are built on trust and transparency. Abnormal is committed to providing secure products that protect your data and build your trust.

Not yet an Abnormal customer? Request a demo today to learn how Abnormal can enhance your email security capabilities and provide visibility into email threats that other solutions miss.